Downloading NodeJS modules and containers from "public" data sources that are either vetted or are vetted by unknown parties, isStupid == TRUE. Play stupid games, win stupid prizes. It's unfortunately not a problem specific to Node, goes back to at least the early Linux kernel and CPAN days. As GenZ has invaded Wall Street, they have started to pay attention to this concern and call it a "supply chain integrity" issue. Ironically, GenZ also leads the charge in most companies to "trust everything" because "everyone is doing it." (In most corporations, "perception is the reality" and if everyone perceives jumping off the cliff is The Way https://youtu.be/V-SJQdREDKM)

A solution is for ID.me to begin issuing developer certificates (for free to those offering themselves up as developers) and for the old system of public repositories and mirrors to be replaced by a single source of truth operated by a new entity jointly sponsored by the $15.4 Trillion worth of companies: Amazon, Google, Meta, Apple, nVidia, Tesla and Microsoft in such a way that everything in every repository can be traced back to the actual biometric signature of a developer and their related IRL context. These entity, its sponsors and ID.me also need to observe a regulation that they will NOT "track" or share information between each other (or others) about developers indexed off their developer certificates beyond what's necessary to host the repositories and to manage access to developer-only programs (such as Xcode signing, etc.) Ideally the JV will be located in Switzerland (perhaps with the hardware located in a Svalbard-like facility) using some UN supervised process (overseen by Nato, Russia, China and the Plebeians) to vet all workers.